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FAQ: APD DECISION ON IAB EUROPE 
AND TCF - Updated March 2024 


The Belgian Data Protection Authority (APD) handed down on 2 February 2022 a decision on 
IAB Europe and the Transparency & Consent Framework (TCF). The decision identifies IAB 
Europe as a (joint) data controller for the processing of TC Strings (digital signals containing 
user preferences the APD considered to be personal data) as well as for subsequent processing 
of personal data in the context of the TCF. You can read the full decision here. 


On 4 March 2022, IAB Europe filed an appeal against the APD decision of February 
2022 before the Market Court (Court of Appeal of Brussels), because it claimed that IAB 
Europe acted in breach of the General Data Protection Regulation (GDPR). 

On 7 September 2022, the Market Court referred preliminary questions to the Court of 
Justice of the European Union (CJEU) and suspended its deliberation on the merits of 
the case (see “about the appeal before the Belgian Market Court and referral to the 
CJEU”’). The Market Court also confirmed in line with IAB Europe’s arguments, that the 
APD decision failed to meet the relevant standard for proper investigation and 
fact-finding. 

On 7 March 2024, the CJEU rendered its judgement, allowing the proceedings to 
resume before the Market Court. You can read the summary of the judgement here. 


Because the APD decision initially remained provisionally enforceable pending the appeal 
procedure detailed above: 


On 1 April 2022, IAB Europe submitted an action plan in line with the orders of the APD 
decision of February 2022. Each step described in the action plan is the result of a 
careful assessment of which measures are best suited to meet the APD’s interpretation 
of the GDPR and deliver extended compliance functionality to the TCF. 

On 11 January 2023, the APD issued a decision which informed IAB Europe that it had 
validated all points of the action plan. Following IAB Europe’s appeal against the 
validation decision before the Belgian Market Court, the APD has voluntarily suspended 
the implementation period to execute the action plan until a final ruling is rendered. (see 
“about the execution of the decision and IAB Europe’s action plan’). 

On 6 September 2023, the Belgian Market Court rendered an interim ruling and 
confirmed in line with IAB Europe’s arguments that the answers that will be provided by 
the CJEU will have a bearing on the legality of the APD decision to validate the action 
plan. The APD voluntary suspension of the implementation period continues to apply 
until the Market Court renders a final ruling. 


ABOUT THE APPEAL BEFORE THE BELGIAN MARKET COURT AND REFERRAL TO THE 


CJEU 


Why is IAB Europe appealing the APD decision? 
What did the Belgian Market Court do in the ruling issued on 7th September? 
Why has the Belgian Market Court referred questions to the CJEU? 
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What were the questions referred to the CJEU for a preliminary ruling? 4 
What does the CJEU ruling say? 4 
Does this mean that consent popups or the TCF are illegal? 4 
What are the next steps? Do TCF participants need to change their implementation? 5 
ABOUT THE EXECUTION OF THE DECISION AND IAB EUROPE’S ACTION PLAN 5 
Why did IAB Europe submit an action plan to the APD? 5 
Why did the APD validate the action plan ? 5 


Why did IAB Europe appeal the APD decision to validate its action plan and seeked interim 
measures? 


Can the APD require the execution of the action plan now that the CJEU ruling has been 
rendered? 


What did the validation of the action plan mean for the TCF? 
Did IAB Europe already execute the action plan? 
Has the action plan been examined by other data protection authorities as well? 
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ABOUT THE APPEAL BEFORE THE BELGIAN MARKET COURT 
AND REFERRAL TO THE CJEU 


Why is IAB Europe appealing the APD decision? 


IAB Europe is appealing the February 2022 decision because it considers it to be wrong both in 
its assessment of the facts and in its legal analysis. The APD fails to justify its position on two 
fundamental issues, namely its claims that the TC Strings involve the processing of personal 
data and that IAB Europe acts as controller in relation to the TC Strings, despite the fact that 
IAB Europe is merely managing the framework, not the technologies implementing the 
framework or the actual processing based on the framework. Beyond these two fundamental 
points, the APD alleged that the TCF in its current form is unfit to provide transparency and 
demonstrate a lawful basis for certain data processing, but did not provide any tangible 
justification for this position; instead, the APD merely carried out a limited assessment of the 
minimum requirements laid down in the TCF Policies and Technical Specifications, with no 
case-by-case investigation of the actual measures taken by TCF participants to comply with 
their own data protection obligations. 


IAB Europe disputes notably the controversial and novel allegation that it acts as a controller for 
the recording of TC Strings (the digital signals containing user preferences about the processing 
of their personal data), and as a joint controller for the dissemination of TC Strings and other 
data processing done by TCF Vendors under the OpenRTB protocol. IAB Europe also 
challenges the APD’s assessments on the validity of legal bases established by the TCF, which 
were done in the abstract, without reference to the particular circumstances surrounding any 
discrete act of data processing. 


iab 


ope 


= 
= 
0) 
© 


What did the Belgian Market Court do in the ruling issued on 7th September? 


The ruling issued on 7th September is an “interim ruling”. In it, the Belgian Market Court 
provided its findings on the procedural arguments raised by IAB Europe in its appeal but asked 
two questions to the CJEU and suspended its reflection on the substantive arguments (i.e. 
arguments regarding the alleged GDPR infringements) pending answers from the CJEU. The 
questions concern, respectively, (i) whether the TC String — the digital signal containing user 
preferences about the processing of their personal data — constitutes personal data under the 
GDPR and (ii) whether IAB Europe should be considered to be a controller for personal data 
processed under the TCF (both in relation to the TC String and even in relation to further 
processing, for instance targeted online advertising by Publishers and Vendors). 


The Market Court will resume its examination of IAB Europe’s other substantive arguments in 
line with the answers provided by the CJEU. Notably, in its appeal, IAB Europe also challenged 
all of the APD’s assessments about the validity of legal bases established by the TCF. 


The Market Court has already ruled on the procedural part of the appeal, i.e. the points 
challenging the way the APD handled the enforcement procedure against IAB Europe. The 
Market Court confirmed in the interim ruling, in line with IAB Europe’s arguments, that the APD’s 
February 2022 decision was insufficiently substantiated in relation to the issue of whether a TC 
String is personal data and that the decision failed to meet the relevant standard for proper 
investigation and fact-finding - which will have a bearing on the ultimate outcome of the case, 
irrespective of the CJEU’s answers. 


Why has the Belgian Market Court referred questions to the CJEU? 


In its interim ruling, the Market Court explained that it is not self-evident that IAB Europe should 
be considered as a data controller for the processing of personal data within the TCF or that TC 
Strings should be considered personal data. The Market Court noted that the CJEU has not yet 
had the opportunity to rule on the “new and far-reaching technology” at issue in the contested 
decision. 


IAB Europe had (i) rejected the APD’s allegation that the TC String is personal data for IAB 
Europe, arguing that the Internet user whose choices go into a TC String is not identified or 
identifiable for IAB Europe, and (ii) rejected the APD’s allegation that it is a controller, arguing 
that this reflected an incorrect interpretation of the GDPR and would have grave negative 
implications for standard-setting organisations everywhere. In its final written submission to the 
Market Court, the APD itself suggested a referral to the European Court on the second issue, 
while the complainants in the case themselves suggested a referral on both issues. The broad 
implications of the APD’s sweeping interpretation of the concepts of personal data and 
controllership made a referral to the CJEU a logical next step. 
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What were the questions referred to the CJEU for a preliminary ruling? 


The preliminary questions relate to two set of questions: 

1- a) Does the TC String constitute personal data for IAB Europe? 

b) Does it make a difference if the TC String is always combined with an IP address? 
c) Does it make a difference if IAB Europe has no legal access to it? 


2- a) Does IAB Europe qualify as a (joint) data controller for the processing of TC String? 

b) Does it make a difference if IAB Europe has no legal access to it? 

c) Does IAB Europe qualify as a (joint) data controller for subsequent processing performed in 
pursuit of the TCF purposes? 


The precise list of questions that were referred to the CJEU can be found here. 


What does the CJEU ruling say? 


The CJEU handed down its ruling on 7 March 2024. In its judgement, the CJEU establishes 
that: 

(i) TC Strings (digital signals containing user preferences) constitute personal data, even from 
the perspective of IAB Europe, when they can be linked with reasonable means to an identifier 
such as for instance the IP address of the device of the user and IAB Europe can have access 
to such data; 

(ii) IAB Europe can be viewed as a joint controller together with TCF participants in relation to 
the creation and use of TC Strings by publishers and vendors, on the basis that the TCF 
provides specifications for its processing, if IAB Europe actually influences the processing 
(purposes and means) for its own reasons. 

(iii) IAB Europe should not necessarily be viewed as a joint controller together with TCF 
participants in relation to the subsequent data processing performed in pursuit of the TCF 
purposes, such as digital advertising, audience measurement, or content personalisation since 
IAB Europe has no influence on such processing. The CJEU conclusion on the latter is 
particularly important, as the APD’s erroneous controllership qualification of IAB Europe over 
such processing served as a basis for the authority’s assessments of the validity of legal bases 
established through the TCF and corresponding sanctions. 


Does this mean that consent popups or the TCF are illegal? 


No. The CJEU ruling relates solely to those two key questions (“Is the TC String personal data?” 
and “Is IAB Europe a (joint) controller regarding processing further to implementation of the 
TCF?”) and does not contain any broader considerations on consent prompts. There is 
therefore nothing in the CJEU ruling that could be viewed as even remotely questioning the 
legality of consent prompts or prohibiting their use by the digital ecosystem to comply with legal 
requirements under the EU’s data protection framework. The CJEU ruling furthermore does not 
examine whether any activities of IAB Europe or TCF participants could be deemed any GDPR 
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breaches. Instead, it only provides clarifications regarding the concepts of personal data and 
controllership and how they could apply depending on the circumstances. 


What are the next steps? 


The Belgian Market Court will now resume its examination of IAB Europe’s substantive 
arguments in line with the answers provided by the CJEU - which can take several months. 


Pending the conclusion of the proceedings before the Market Court, the suspension of the 
execution of the APD decision (i.e. the implementation of IAB Europe’s action plan following its 
validation) continues to apply (see “Can the APD require the execution of the action plan 
now that the CJEU ruling has been rendered?’). 


ABOUT THE EXECUTION OF THE DECISION AND IAB EUROPE’S 
ACTION PLAN 


Why did IAB Europe submit an action plan to the APD? 


The APD decision of February 2022 remains provisionally enforceable pending the outcome of 
the appeal proceedings. For this reason, on 1 April 2022, IAB Europe submitted to the APD the 
action plan required by the decision. 


Each step described in the action plan is the result of a careful assessment of which measures 
are best suited to meet the APD’s interpretation of the GDPR (as laid out by the APD in 
February 2022) and deliver extended compliance functionality to the TCF. It reflects a 
collaborative effort and in-depth discussions amongst IAB Europe member companies and 
associations, which convene in the TCF working groups to iterate the TCF, to meet the 
expectations of the APD. 


Why did the APD validate the action plan ? 


When IAB Europe initially asked that enforcement of the APD decision of February 2022 be put 
on hold until a final ruling by the Market Court on the merits of the appeal, the APD committed to 
wait until after September 2022 before validating the action plan, date by which the Market 
Court was expected to have issued a final ruling on the appeal. 


However, following the Market Court’s interim ruling, through which it referred questions to the 
CJEU, the APD informed IAB Europe that it intended to further examine the action plan without 
waiting for the end of the appeal proceedings. 


While the action plan could have served as a basis for discussion with IAB Europe on how best 
to deliver extended functionality to the TCF pending the procedure before the CJEU, the APD 
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decided to formally validate all points of the action plan on 11 January 2023 - preempting 
responses from the CJEU on the core issues of what is “personal data” and who can be viewed 
as a “controller”. 


It is unclear why the APD decided to move forward with the validation of the action plan instead 
of engaging in a dialogue with IAB Europe to seek evolutions to the TCF, as the CJEU had not 
yet rendered its judgement. 


Why did IAB Europe appeal the APD decision to validate its action plan and seeked 
interim measures? 


The measures proposed in the action plan stem directly from the assumption that (i) the TC 
String (a digital signal containing user preferences) should be considered personal data and that 
(ii) IAB Europe acts as a (joint) controller for the dissemination of TC Strings and other data 
processing done by TCF participants. Both of these assumptions have been referred to the 
Court of Justice of the European Union (CJEU) by the Belgian Market Court for a preliminary 
ruling. 


The challenge filed by IAB Europe in response to the APD’s decision to validate the action plan 
is therefore intended to prevent the APD from preempting the CJEU’s responses. This way, the 
APD can be prevented from enforcing implementation of changes to the TCF that may need to 
be rolled back when the CJEU’s ruling is rendered, if the CJEU agrees with IAB Europe’s 
arguments. This formal challenge turned out to be indispensable as the APD has not shown any 
clear willingness to engage in dialogue with IAB Europe following its decision of January 2023, 
and seems unlikely to provide guidance between now and 11th July 2023. 


Did IAB Europe obtain interim measures regarding the validation decision? 


Yes, following IAB Europe’s appeal and request for interim measures before the Belgian Market 
Court in relation to the APD’s decision to validate the action plan and to launch a six-month 
implementation period, the APD has decided to suspend that implementation period voluntarily 
until the Market Court renders a final ruling on IAB Europe’s second appeal. As a result, the 
initial deadline of 11 July 2023 ceased to apply. 


On 6 September 2023, the Market Court rendered an interim ruling and suspended its 
deliberation on the merits of the case until the CJEU’s ruling is rendered. In this interim ruling, 
the Market Court confirmed in line with IAB Europe’s arguments that the answers that will be 
provided by the CJEU will have a bearing on the legality of the APD decision to validate the 
action plan. 


Can the APD require the execution of the action plan now that the CJEU ruling has been 
rendered? 
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No, the APD voluntary suspension of the implementation period continues to apply until the 
Market Court resumes its deliberation on the merits of the case and renders a final ruling - which 
can take several months. 


However, pending the final ruling from the Belgian Market Court, IAB Europe has moved 
forward with certain iterations to the TCF that were included in the action plan and less 
impacted by the CJEU procedure, as well as additional measures to extend the compliance 
functionality of the TCF (see here the launch announcement of TCF v2.2). 


What did the validation of the action plan mean for the TCF? 


The validation of the action plan confirms the legal functionality of the Transparency and 
Consent Framework (TCF) within the provisions of the General Data Protection Regulation 
(GDPR). While IAB Europe was pleased that the action plan was favourably received by the 
APD, it had grave reservations about the APD preempting responses from the CJEU. The 
APD’s approach regarding the action plan would in practice require implementation of changes 
to the TCF that might need to be rolled back at the end of the appeal proceedings. 


Did IAB Europe already execute the action plan? 


Following the validation of the action plan and despite obtaining the suspension of its execution, 
IAB Europe has voluntary moved forward with releasing iterations to the TCF that were included 
in the action plan and less impacted by the CJEU procedure, as well as additional measures to 
extend the compliance functionality of the TCF (see here the launch announcement of TCF 
v2.2). This included: 


1) Removal of the legitimate interest legal basis for advertising & content personalisation: 
within the scope of the TCF, Vendors can only select consent as an acceptable legal 
basis for purposes 3, 4, 5 and 6 at registration level; 

2) Improvements to the information provided to end-users: the purposes and features’ 
names and descriptions changed. The legal text was removed and replaced by 
user-friendly descriptions - supplemented by examples of real-use cases (illustrations); 

3) Standardisation of additional information about Vendors: Vendors are required to provide 
additional information about their data processing operations - so that this information 
can in turn be disclosed to end-users; 

e Categories of data collected 
e Retention periods on a per-purpose basis 
e Legitimate interest(s) at stake - where applicable 

4) Transparency over the number of Vendors: CMPs are required to disclose the total 
number of Vendors seeking to establish a legal basis on the first layer of their Uls; 

5) Specific requirements to facilitate users’ withdrawal of consent: Publishers and CMPs 
will need to ensure that users can resurface the CMP Uls and withdraw consent easily. 


Additionally, IAB Europe also moved forward with: 
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6) Deprecation of the “Global scope” functionality: IAB Europe revoked the delegation of 
consensu.org subdomains to CMPs’ servers; 

7) Release of updated Compliance Programmes: IAB Europe launched new auditing 
mechanisms and differentiated enforcement procedures (see here). 


Has the action plan been examined by other data protection authorities as well? 


In accordance with Article 60 (10) GDPR, as further interpreted by the European Data 
Protection Board in para. 249 of its Guidelines 02/2022, the APD is required to inform the other 
concerned authorities (i.e. the data protection authorities that the APD consulted under the 
cooperation procedure prior to finalising its February 2022 decision) of any “measures taken for 
complying with the [APD’s] decision’, such as the action plan and the actual implementation 
thereof, notably to ensure the consistent application of the GDPR across the EU. It is IAB 
Europe’s understanding that interactions with other data protection authorities took place in 
practice during the APD’s assessment of the action plan. 


